Simple Machines Forum Moderation Zone Information Disclosure Vulnerability

Bugtraq ID:	49078
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 07 2011 12:00AM
Updated:	Aug 07 2011 12:00AM
Credit:	The X-C3LL and seth
Vulnerable:	Simple Machines Simple Machines Forum 2.0
Not Vulnerable:

Simple Machines Forum Moderation Zone Information Disclosure Vulnerability

Simple Machines Forum is prone to an information-disclosure vulnerability because it includes session credentials in the URL in certain circumstances.

An attacker can exploit this issue to gain access to valid session credentials; this may aid in further attacks.

Simple Machines Forum 2.0 is vulnerable; other versions may also be affected.

Simple Machines Forum Moderation Zone Information Disclosure Vulnerability

Attackers can exploit this issue via a browser.

Simple Machines Forum Moderation Zone Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Simple Machines Forum Moderation Zone Information Disclosure Vulnerability

References:

• Simple Machines forum (SMF) 2.0 session hijacking (seth)
  
• Simple Machines SMF Homepage (Simple Machines)